CVE-2026-24233 is a deserialization of untrusted data vulnerability (CWE-502) in NVIDIA TensorRT-LLM for Linux. The issue exists in the restricted unpickler component responsible for deserializing model weights. An attacker with local access and no authentication can exploit this flaw to execute arbitrary code, escalate privileges, tamper with data, or disclose sensitive information. The vulnerability has a CVSS 3.1 base score of 8.4, reflecting high impact on confidentiality, integrity, and availability. As of the published date, no patch or official remediation level has been disclosed by NVIDIA.

Successful exploitation can result in arbitrary code execution, escalation of privileges, unauthorized data modification, and information disclosure on affected systems running NVIDIA TensorRT-LLM. The attacker requires local access but no authentication, increasing the risk in multi-user or shared environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit local access to trusted users only and monitor for suspicious activity related to TensorRT-LLM usage. Avoid loading untrusted model weights to reduce exposure.